I. Introduction

Revolution Medicines, Inc., and its affiliates (collectively “Revolution Medicines,” “we”, “us” and “our”) takes the privacy and security of your Personal Information seriously. This Privacy Notice (“Notice”) applies to our collection and use of Personal Information both offline and online, including through our websites that link to this Notice, including www.revmed.com, expectras.com, revmedclinicaltrials.com, and ir.revmed.com (collectively, the “Site” or “Sites”). This Notice provides you information on what we gather and do with the data you provide when you interact with us via our Sites. This Notice does not apply to information we may collect through our clinical trials, which are governed by separate policies, terms and/or agreements.

Notice at Collection for California residents: Please see the California Notice section for additional information for individuals residing in the state of California below.

Consumer Health Data Privacy Notice: If you are located in the states of Washington, Nevada, or Connecticut, please visit our Consumer Health Data Privacy Notice linked on our Site for information about how we process your health-related information.

For the purposes of our processing of Personal Information as described in this Notice, Revolution Medicines is the data controller as such term is defined under Applicable Data Protection Laws. Depending on the nature of your interaction with us, Revolution Medicines group companies may act as independent controllers or joint controllers for the processing activities described in this Notice.

II. Information We May Collect About You

Personal Information

We may collect and process Personal Information (sometimes referred to as personal data under Applicable Data Protection Laws) you provide to us, such as your contact information, information about your health, or other Personal Information you provide to us when you:

Register to use our Sites;
Complete an online form (e.g., to obtain email updates such as investor relations or ask us to send you information, apply for a job, submit a grant request, or participate in a survey);
Participate in our patient support services;
Authorize your healthcare provider(s) or insurance provider(s) to share your health information and other Personal Information with us;
Communicate with us, including via email or phone;
Participate in discussion boards or other social media functions that may be connected with our Sites; or
Provide information to use offline regarding our business-related interactions with you (e.g., information you provide us at an industry event).

We may supplement or combine information we collect online with Personal Information about you from other resources, which could include commercially available sources, such as public databases and data aggregators to the extent permitted by applicable data protection laws.

We may obtain sensitive Personal Information about you, for example, if you voluntarily provide information about your health, ethnicity or race as part of a request for information. Where required by applicable law, we will obtain your explicit consent before processing special categories of Personal Information, unless another legal basis applies..

We may also receive information from your device, including IP address (including approximate geolocation inferred from that address), web browser type, operating system version (to the extent applicable), and device identifiers. We receive information about your interactions with our Site, such as the time spent interacting with content and the dates and times of your visits. This may include certain information collected via cookies and similar technologies (including your preferences in respect of the use of those technologies). For more information on these technologies, please see our Cookies Notice.

III. How We Use the Personal Information You Provide to Us

Subject to applicable data protection laws, we may use your Personal Information that we collect or receive for the following purposes:

To provide you with the services, including patient support services;
To process your requests and respond to your inquiries;
Register you for any services you have signed up for;
For business administration, including statistical analysis and as may be required to perform our obligations under a contractual relationship with you;
To personalize your visit to our Sites and to assist you while you use our Sites;
To improve our Sites by helping us understand who uses our Sites;
To send promotional information to you regarding content, programs, products and services which we believe may interest you if you have not opted out; we will do this only with your consent if required under applicable laws;
To provide you with medical and disease information we believe may interest you;
Fulfill legal and compliance obligations, such as adverse event reporting, fraud and detection, and to comply with applicable laws, regulations or codes of practice, and in response to lawful requests by public authorities, including to meet national security or law enforcement requirements;
To develop or enhance a business relationship or support a corporate transaction;
To protect, maintain and enforce the rights, property, or safety of us, or any of our respective business partners, or other Third Parties in accordance with applicable laws; and
In some cases, for further uses beyond those listed above. In those cases, we will ask for your consent to use your Personal Information.

IV. Disclosure of Personal Information

We may disclose Personal Information to Third Parties with your consent or as otherwise necessary or appropriate to process a transaction that you may request and carry out our relationship with you.

We may further disclose Personal Information that we collect as follows:

To our affiliated businesses;
To service providers that provide services (also sometimes called data processors) on our behalf pursuant to a contract requiring the service providers to protect your Personal Information; or
To our professional service providers, such lawyers, bankers, auditors and insurers, and other professional advisers to provide consultancy, banking, legal, insurance, accounting, or similar services to us.

In the event that our company or some of our assets are sold or transferred or used as security or to the extent we engage in business negotiations with our business partners, the Personal Information we collect may be transferred or shared with Third Parties as part of that transaction or negotiation.

We may disclose Personal Information to comply with our legal or regulatory obligations, in response to a request for information made by a government agency, or as part of an investigation of unlawful activity. We reserve the right to disclose Personal Information that we believe, in good faith, is appropriate or necessary to: (i) take precautions against liability; (ii) protect ourselves or others from fraudulent, abusive or unlawful uses or activity; (iii) investigate and defend ourselves against any Third Party claims or allegations; (iv) protect the security and integrity of the Site and any facilities or equipment used to make the Site available; or (v) protect our property or other legal rights (including, but not limited to, enforcement of our agreements), or the rights, property, or safety of others.

Please refer to our Cookies Notice to view the specific third parties that may access Personal Information for purposes of targeted advertising, which may be considered a “sale” of data under state privacy laws.

We do not collect, use, or sell personal data for the purpose of training large language models.

V. Data Security

The security of your Personal Information is important to us. We take reasonable steps, including technical, administrative and physical safeguards, designed to protect the Personal Information submitted to us from loss, misuse and unauthorized access, disclosure, alteration and destruction. We will ask any agents and service providers to whom we may transfer your information take comparable steps to maintain that security. However, no method of security or method of transmission over the Internet is entirely secure. You should always use caution when transmitting Personal Information over the Internet.

VI. Data Retention

We may retain and process your Personal Information for as long as you continue to use our services, including accessing or using any Site and, in general, for the period necessary to achieve the purposes set out above. Where permitted by applicable laws, we will retain your Personal Information to comply with our legal obligations, resolve legal disputes and enforce our agreements.

VII. Privacy Settings/Opt-Out

We provide the following choices regarding your Personal Information:

You may opt-out of receiving promotional or marketing emails from us at any time by using the “unsubscribe” link in the email you receive. Please note that we reserve the right to continue to send you other, non-marketing communications, including messages regarding invoices, deliveries and educational materials.
If you opt-in to receiving informational text messages from us, you can opt-out at any time by replying “STOP.”

You may contact us at the contact information below if you think that any Personal Information we have about you is inaccurate or incomplete, or if you want to access your Personal Information.

VIII. Your Privacy Rights

Depending on your jurisdiction of residence, you may have the privacy rights listed below with respect to the Personal Information we collect about you. Please note that these rights are not absolute; they may apply only in certain circumstances. In certain cases, we may decline a request you make as permitted by law.

Right to Confirm / Access / Know. You may have the right to request access to Personal Information that we hold about you, including details relating to the ways in which we use and share your information. Residents of California have the right to know the categories of Personal Information we have collected about them, the categories of sources from which the Personal Information is collected, the categories of Personal Information sold, shared or disclosed, the business or commercial purpose for selling, sharing or disclosing the Personal Information and the categories of Third Parties to whom we have sold, shared or disclosed their Personal Information.
Right to Delete. You may have the right to request that we delete Personal Information we maintain about you.
Right to Correct. You may have the right to request that we correct inaccurate Personal Information we maintain about you.
Right of Portability. You may have the right to receive a copy of the Personal Information we hold about you and to request that we transfer it to a Third Party. This right exists in certain circumstances and with certain exceptions.
Right to Withdraw Consent to Processing of Sensitive Personal Information. You may have the right to withdraw your consent to the collection, use and disclosure of your sensitive Personal Information, unless legal or contractual reasons prevent you from doing so. However, if you withdraw your consent, we may be unable to offer or provide you with certain goods and services.
Right to Opt-Out. You may have the right to opt-out of certain uses of your Personal Information, such as (i) targeted advertising, (ii) “sale” or “sharing” for cross-context behavioral advertising, or (iii) profiling or automated decision-making activities that result in a legal or similarly significant effect on you. Please note that if you visit our Sites with the Global Privacy Control opt-out preference signal enabled, if required by law, we will respond to that request in a frictionless manner, meaning we will automatically treat this as a request to opt-out of “sale,” “sharing,” or targeted advertising for the device or browser from which you broadcast the signal.
Right to Object or Restrict. You may have the right to object to, or restrict, our processing of your Personal Information.
Right to Appeal. You may have a right to appeal our decision if we decline to process your request in part or in full. You can do so by replying directly to our denial. If you are not satisfied with our response to your appeal, you may contact your state Attorney General.
Right to List of Third Parties. You may have the right to obtain a list of third parties to which we have disclosed Personal Information.

We do not engage in profiling activities that further automated decisions producing legal or similarly significant effects; however, to the extent your personal information is ever used in that way, you additionally have the right to opt-out of profiling activity that furthers an automated decision producing legal or similarly significant effects, and the right to information on profiling if any profiling is done for the purposes of an automated decision that produces legal or similarly significant effect, including to question the results of profiling, to be informed of the reason profiling resulted in a particular decision, to review your personal data that was processed for the purposes of profiling, to correct incorrect personal data processed for profiling and to have the profiling decision reevaluated accordingly.

Requests to exercise these rights may be made using the contact information listed at the end of this Notice. As discussed above, a request to opt-out of the sale or sharing of your Personal Information can be made by utilizing the cookies preference center or activating the Global Privacy Control.

If you are located in the European Economic Area (“EEA”), United Kingdom (“UK”), Switzerland, or Japan, you also have the right to lodge a complaint with a supervisory authority.

A list of the European authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
The contact information for the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) can be found at https://www.edoeb.admin.ch/en.

The contact of the UK Information Commissioner’s Office (“ICO”) can be found at https://ico.org.uk/.

The Japanese Personal Information Protection Commission (“PPC”) provides information regarding complaints on specific matters related to your Personal Information at https://www.ppc.go.jp/legal/complaints/.

IX. Exercising Your Privacy Rights

Only you, or as permitted by law, a person that you authorize to act on your behalf, may make a request related to your Personal Information. In the case of access, correction and deletion, your request must be verified before we can fulfill the request. Verifying your request will require you to provide sufficient information for us to reasonably verify that you are the person about whom we collected Personal Information or that the requestor is authorized to act on your behalf. We will not discriminate against you for exercising your privacy rights.

Requests to exercise your privacy rights should be submitted by email at privacy@revmed.com or by postal mail at the following address: Revolution Medicines, Inc., Attn: General Counsel, 700 Saginaw Drive, Redwood City, CA 94063. We will attend to your request in a timely manner and in accordance with applicable law. If for any reason we need to extend this period of time, we will contact you.

California Privacy Rights

California’s “Shine the Light” law permits California residents to annually request and obtain information free of charge about what Personal Information is disclosed to Third Parties for third-party direct marketing purposes in the preceding calendar year. We do not distribute your Personal Information to Third Parties for third-party direct marketing purposes, except as provided for in this Notice.

X. External Links

The Site may, from time to time, contain links to external sites operated by Third Parties. We are not responsible for these Third Party sites or the content of such Third Party sites. Once you have left the Site, we cannot be responsible for the protection and privacy of any information which you provide.

XI. Minors

This Site is not directed towards children under 16 years of age, nor do we knowingly collect information from children under 16. If you are under 16, please do not use the Site or submit any Personal Information to us. If you believe that we have unintentionally collected Personal Information about your child, you can contact us by mail or email as described below.

XII. European, UK, and Swiss Users

The information below applies only to individuals in the EEA, UK, and Switzerland.

Revolution Medicines, Inc. is the Controller of the processing of your Personal Information covered by this Notice for purposes of European data protection legislation, including the General Data Protection Regulation (“GDPR”) of the European Union and similar legislation in the UK and Switzerland. References to your “Personal Information” in this Notice should be understood to include a reference to your “Personal Information” or “Personal Data” as defined in the GDPR and is information about you, from which you are either directly identified or can be identified.

Legal Basis and Purpose of Use

In respect of each of the purposes for which we use your Personal Information, the GDPR requires us to ensure that we have a “legal basis” for that use. Our legal bases for processing your Personal Information described in this Notice are:

Where it is necessary for our legitimate interest and your interests and fundamental rights do not override those interests (e.g. dealing with inquiries and contacts, communications on our products or services, business operations, Site operations, and analytics);
Where we need to comply with a legal or regulatory obligation (e.g. protection and enforcement of rights or cooperation with law enforcement); and
Where we have your specific consent to carry out the processing for the purpose in question (e.g. analytics, Site operations where cookies and tracking technologies are used, and any further use).

In addition, where we process special categories of Personal Data (including health information), we do so only where permitted by applicable law, including:

with your explicit consent;
where necessary for reasons of public interest in the area of public health;
where necessary to comply with legal obligations relating to pharmacovigilance, product safety or regulatory reporting; or
where otherwise permitted under Article 9 GDPR and equivalent laws.

If you have questions about how we process your Personal Information or if you would like to submit a complaint, our representatives can be contacted at:

Revolution Medicines, Inc.’s EU Data Protection Officer

Contact Email: privacy@revmed.com

XIII. Japan Users

If you are located in Japan, your Personal Information is protected under the Act on the Protection of Personal Information (“APPI”). The APPI requires us to ensure that we have specified as much as possible the purpose for which we use your Personal Information. Please refer to the How We Use the Personal Information You Provide to Us section above for purposes for which we use your Personal Information. Your Personal Information will not be used beyond the scope necessary for achieving the purposes specified in this Notice without your prior consent. Any alteration of the purpose of use will be notified to you or publicly disclosed and will not go beyond what can be appreciably linked to the original purpose. Subject to limited exceptions under the APPI, we will not collect your sensitive Personal Information without obtaining your prior consent to do so.

If you have questions about how we process your Personal Information or if you would like to submit a complaint, our representative can be contacted at:

Revolution Medicines, Inc.’s Japan Data Protection Representative

Contact Email: privacy@revmed.com

XIV. Intra-Group and Cross-Border Data Transfers

We may share Personal Information among Revolution Medicines group companies for purposes including business administration, compliance, pharmacovigilance, information technology support, medical affairs, commercial operations and responding to inquiries.

If you are located outside the United States and interact with us via one of our websites, mail, email, or phone, your Personal Information may be transferred to, stored in, or processed in countries other than the country in which it was collected, including the United States. Revolution Medicines takes appropriate measures to protect Personal Information transferred across national borders in accordance with applicable data protection laws.

Where applicable, including for transfers subject to data protection laws in the EEA, UK, Switzerland, or Japan, Revolution Medicines implements appropriate safeguards and lawful transfer mechanisms, which may include Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or other mechanisms permitted by applicable law.

XV. Notice Changes

We may update this Notice from time to time without prior notice. Any changes to our Notice will become effective upon posting of the updated Notice on our Site. If we change this Notice, we will revise the “last updated” date at the top thereof. We encourage you to bookmark our internet sites and to periodically review them to ensure familiarity with the most current version of our Notice.

XVI. Contact Us

If you have any questions, comments or suggestions about this Notice or our privacy practices, please contact us at privacy@revmed.com. Alternately, letters may be sent to the following address: Revolution Medicines, Inc., Attn: General Counsel, 700 Saginaw Drive, Redwood City, CA 94063.

XVII. California Notice at Collection

For the purposes of the California Consumer Privacy Act (CCPA), the information provided in this Notice is applicable to all California residents. The CCPA also requires us to make the following additional disclosures to California residents regarding our information practices.

Data Collected from California Residents

In the last twelve (12) months, the Personal Information Revolution Medicines has collected falls into the following categories of Personal Information as defined under California law:

Identifiers and Personal Information categories listed in the California Customer Records statute, such as name, signature, address, phone number, email address, online identifier, unique identifier, social media username, IP address, date of birth, medical information and health insurance information. We collect this category of information directly from you, automatically from your use of the Sites, and from Third Parties.
Protected classification characteristics, such as age, gender, race, color, ancestry, national origin, disability, citizenship and veteran or military status. We collect this information directly from you.
Employment information, such as your resume, job title, contact details, and employment history. We collect this information from our business partners, such as CROs.
Educational information, such as educational degrees. We collect this information from our business partners, such as CROs.
Commercial information, such as records of personal property, products or services purchased or used by you through our Sites. We collect this category of information directly from you, automatically from your use of the Sites, and from our business partners.
Internet or other similar network activity, such as browsing history, search history, information on a consumer’s interaction with a website, application or advertisement. We collect this category of information automatically from your use of the Sites.
Geolocation data, such as device region. We collect this category of information automatically from your use of the Sites.
Sensory data, such as recordings of customer service calls. We collect this category of information automatically.
Sensitive Personal Information, such as precise geolocation, racial or ethnic origin, citizenship or immigration status, and health data. We collect health data directly from patients, from their caregivers and from providers and insurers. We do not collect precise geolocation information. To the extent we collect sensitive Personal Information, we do not use it to infer characteristics about individuals.

Collection of professional or employment information and non-public education information is addressed in our Employee Privacy Policy linked above.

Disclosures

Revolution Medicines uses and discloses this Personal Information in the manner set forth in the “Disclosures of Personal Information” section of this Notice. In the past 12 months, we have disclosed some or all of the above categories of Personal Information to our service providers. In addition, we have disclosed the following categories of Personal Information to Third Parties for purpose of providing our products and services, including facilitating patient assistance, and to regulatory bodies for the purpose of complying with legal and regulatory obligations: identifiers and Personal Information categories listed in the California Customer Records statute, commercial information, sensitive Personal Information.

Sale and Sharing of Personal Information

Revolution Medicines does not sell Personal Information; however, certain of our digital analytics or advertising activities may constitute a sharing of Personal Information for cross-context behavioral advertising under California law. In particular, we may share the following categories of Personal Information with Third Party advertising and analytics partners for the purposes of data analytics and cross-context behavioral advertising: Identifiers and Personal Information categories listed in the California Customer Records statute, commercial information, and internet or other similar network activity. California residents have the right to opt-out of this sharing as described in the “Your Privacy Rights” section of this Notice.

[Effective Date: August 2026 ]

Cookies Notice

This Cookies Notice (“Cookies Notice”) describes how Revolutions Medicines (“RevMed”, “we,” or “us”) and our website at revmed.com, as well as all related websites provided by us (individually or collectively, the “Site”) use and collect tracking technologies. Our website uses first party and third-party Cookies and similar technologies to track our users and the services they have elected according to our website Privacy Policy.

What are Cookies?

A Cookie is a small piece of data (text file) that a website, when visited by a user, asks the browser to store on your device in order to remember information about you, such as your language preference. Below is a detailed list of the Cookies used by us on the Site. The Site is scanned periodically to maintain this list as accurate as possible. Visitors can opt-out of certain categories of Cookies (except strictly necessary Cookies) by toggling off each selection, then clicking “Confirm My Choice” below, or visitors can opt out of all Cookies (except strictly necessary Cookies) by clicking “Disable Cookies”.

In some states and countries, Cookies that are not strictly necessary will not be enabled unless the user accepts or opts in.

If you opt-out of the Cookies, you may still use the Site but tracking information will not be collected. However, visitors will not receive the benefits from the use of Cookies such as recognition of repeat users or provision of advertisements related to specific products that may be of interest to potential individual customers. By using our Site, visitors agree to the collection of certain information that we use to improve the Site functionality. This information is not tied to individuals personally, but is used “in aggregate” to better understand demographics of website visitors (such as location and language), what web pages visitors are most often browsing, the amount of time spent on each page, the device type used to visit the Site, and other technical and commercially relevant information.

Visitors who accept the Cookies on the Cookie banner (“Accept All Cookies”) will opt-in to the collection of some information tied to online activities via certain online tracking mechanisms. The information collected regarding individual browsing activities includes the following:

IP address
Device type
Operating system
Browser language
Web pages visited, time on Site, and total number of pages viewed
Network service provider

Please note that some browsers have a “do not track” feature that allows visitors to directly prevent websites from tracking online activities. These features are not yet uniform and so our Site is not currently configured and enabled to respond to such aggregated signals. However, visitors declining the Cookies on the banner (“Disable Cookies”) will not be tracked. Visitors may have to opt-out separately via each browser and subsequent devices used.

Types of Cookies and Technologies Used

Strictly Necessary Cookies. These Cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these Cookies, but some parts of the Site will not then work. These Cookies do not store any personally identifiable information.
Functional Cookies. These Cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these Cookies then some or all of these services may not function properly.
Performance Cookies. These Cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the Site. All information these Cookies collect is aggregated and therefore anonymous. If you do not allow these Cookies we will not know when you have visited our Site, and will not be able to monitor its performance.
Targeting Cookies. These Cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these Cookies, you will experience less targeted advertising. In some US states, these types of cookies may be considered a “sale” of your Personal Information. Please review our Privacy Policy for more information on how you can opt out of “sale” of your Personal Information, including by declining third-party targeting cookies. If you would like a list of third party tracking technologies, please contact privacy@revmed.com

With Whom We Share Information

We share information with third parties:

Google Analytics uses Cookies and other, similar technologies, to collect information about how users use the website. The information generated by the Cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set forth above. To learn more about Google Analytics, including how to opt out of it, visit https://tools.google.com/dlpage/gaoptout.

Adobe uses Cookies to enhance our digital marketing efforts. These Cookies collect data on user interactions, preferences, and behaviors across our digital platforms. The information gathered is used by Adobe to help us deliver personalized content and advertisements, optimize user experiences on the website, and measure the effectiveness of our marketing campaigns.

Third-party websites or services such as Facebook may use Cookies, pixels, and similar technology to collect or receive information upon visiting this website. We will share this information with the respective services or platforms, but we will not include your personal information. This is specifically for conversion tracking, measurement services and ad targeting based upon interests. If you would like to opt out of this tracking measure for Facebook, please visit http://www.aboutads.info/choices.

Other Technologies and Sources

Web Beacons. We may also use web beacons or similar technology to help us track the effectiveness of our communications. A web beacon (also known as an action tag, a clear gif or pixel tag) is a 1×1 pixel image embedded in a website page used to transparently collect information. For example, we may use a web beacon to count the number of visits to the pages of our site. If you have signed up to receive any of our e-mail newsletters, we use similar technology to count how many recipients have opened the message and clicked on one of its links.

Website (Browser) Opt-out

Visitors have the ability to manage Cookie settings. For example, a visitor can configure the browser to accept all Cookies, reject all Cookies, or notify when a Cookie is set. If certain Cookie types are disabled, however, it may interfere with the functionality of the website and visitors may not be able to use all of the site’s features.

Details on how visitors can control and delete specific Cookies including strictly necessary Cookies through browser settings can be found through the browser’s vendor-specific settings or options page.

For further information about Cookies, including how to see what Cookies have been set on a device and how to manage and delete them, please visit www.allaboutCookies.org.

Contact Information

Please contact us with any questions or comments about this Cookies Notice by email at privacy@revmed.com.

[Effective August 2026]

Global Privacy Notice